PTL 1 discloses an example operation management system which models a system on the basis of correlativity between time series of system performance, and determines the cause of a fault or abnormality of the system by using the generated model.
The operation management system described in PTL 1 determines a correlation function representing a correlation between any two of a plurality of metrics, based on time-series of actual measured values of the plurality of metrics on the system in a normal state (in a learning period). The operation management system then generates a correlation model of the system by selecting correlations depending on weights that are calculated based on an error of the correlation function. The operation management system further detects destruction of the correlation (correlation destruction) by using the generated correlation model, and then determines the cause of a fault in the system based on the correlation destruction. Such technique for analyzing the state of a system based on correlation destruction is called invariant relation analysis.
For example, with respect to a pair of metrics y and u, the invariant relation analysis uses a correlation function for predicting a value of the metric y from a value of the metric u. The analysis then uses a time series as of the time when the model is generated to calculate a difference, i.e., a prediction error between an actual measured value and a predicted value derived from the correlation function for the metric y. Based on the calculated prediction error, the analysis further sets a threshold of prediction errors to be permitted when the system is monitored. When a prediction error exceeds the threshold during the monitoring (i.e., when correlation destruction is detected), the analysis determines that an abnormality has occurred in the system.
PTL 2, which is another related art, discloses a method for monitoring the state of a facility to detect a system abnormality by using a time series of system performance. According to the method for monitoring the state of a facility, as described in PTL 2, operation pattern labels are given at regular intervals to time-series signals outputted from the facility and a normal model is built for each of the labels. To detect abnormalities, operation pattern labels are given during the detection period to the signals so as to detect abnormality using the normal model that has a label in an identical or closer state.
PTL 3, which is still another related art, discloses a method for extracting a basic model and a specific model from a plurality of correlation models generated during a predetermined period on an operation management system subject to invariant relation analysis, based on degrees of fitness with the performance information in the predetermined period.